feat: 웹, 어드민 간 refresh token 분리

src/main/java/com/example/solidconnection/admin/auth/controller/AdminAuthController.java

@@ -0,0 +1,63 @@
+package com.example.solidconnection.admin.auth.controller;
+
+import com.example.solidconnection.admin.auth.dto.AdminReissueResponse;
+import com.example.solidconnection.admin.auth.dto.AdminSignInRequest;
+import com.example.solidconnection.admin.auth.dto.AdminSignInResponse;
+import com.example.solidconnection.admin.auth.dto.AdminSignInResult;
+import com.example.solidconnection.admin.auth.service.AdminAuthService;
+import com.example.solidconnection.common.exception.CustomException;
+import com.example.solidconnection.common.exception.ErrorCode;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/admin/auth")
+@RequiredArgsConstructor
+public class AdminAuthController {
+
+ private final AdminAuthService adminAuthService;
+ private final AdminRefreshTokenCookieManager adminRefreshTokenCookieManager;
+
+ @PostMapping("/sign-in")
+ public ResponseEntity<AdminSignInResponse> signIn(
+ @RequestBody @Valid AdminSignInRequest request,
+ HttpServletResponse response
+ ) {
+ AdminSignInResult result = adminAuthService.signIn(request);
+ adminRefreshTokenCookieManager.setCookie(response, result.adminRefreshToken());
+ return ResponseEntity.ok(AdminSignInResponse.from(result.accessToken()));
+ }
+
+ @PostMapping("/reissue")
+ public ResponseEntity<AdminReissueResponse> reissue(HttpServletRequest request) {
+ String adminRefreshToken = adminRefreshTokenCookieManager.getAdminRefreshToken(request);
+ AdminReissueResponse reissueResponse = adminAuthService.reissue(adminRefreshToken);
+ return ResponseEntity.ok(reissueResponse);
+ }
+
+ @PostMapping("/sign-out")
+ public ResponseEntity<Void> signOut(
+ Authentication authentication,
+ HttpServletResponse response
+ ) {
+ String accessToken = getAccessToken(authentication);
+ adminAuthService.signOut(accessToken);
+ adminRefreshTokenCookieManager.deleteCookie(response);
+ return ResponseEntity.ok().build();
+ }
+
+ private String getAccessToken(Authentication authentication) {
+ if (authentication == null || !(authentication.getCredentials() instanceof String accessToken)) {
+ throw new CustomException(ErrorCode.AUTHENTICATION_FAILED, "엑세스 토큰이 없습니다.");
+ }
+ return accessToken;
+ }
+}

src/main/java/com/example/solidconnection/admin/auth/controller/AdminRefreshTokenCookieManager.java

@@ -0,0 +1,69 @@
+package com.example.solidconnection.admin.auth.controller;
+
+import static com.example.solidconnection.common.exception.ErrorCode.ADMIN_REFRESH_TOKEN_NOT_EXISTS;
+
+import com.example.solidconnection.admin.auth.controller.config.AdminRefreshTokenCookieProperties;
+import com.example.solidconnection.auth.token.config.TokenProperties;
+import com.example.solidconnection.common.exception.CustomException;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.time.Duration;
+import java.util.Arrays;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.web.server.Cookie.SameSite;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseCookie;
+import org.springframework.stereotype.Component;
+
+@Component
+@RequiredArgsConstructor
+public class AdminRefreshTokenCookieManager {
+
+ private static final String PATH = "/";
+
+ private final AdminRefreshTokenCookieProperties properties;
+ private final TokenProperties tokenProperties;
+
+ public void setCookie(HttpServletResponse response, String adminRefreshToken) {
+ Duration tokenExpireTime = tokenProperties.adminRefresh().expireTime();
+ long cookieMaxAge = tokenExpireTime.toSeconds();
+ setAdminRefreshTokenCookie(response, adminRefreshToken, cookieMaxAge);
+ }
+
+ public void deleteCookie(HttpServletResponse response) {
+ setAdminRefreshTokenCookie(response, "", 0);
+ }
+
+ private void setAdminRefreshTokenCookie(
+ HttpServletResponse response, String adminRefreshToken, long maxAge
+ ) {
+ ResponseCookie cookie = ResponseCookie.from(properties.cookieName(), adminRefreshToken)
+ .httpOnly(true)
+ .secure(true)
+ .path(PATH)
+ .maxAge(maxAge)
+ .domain(properties.cookieDomain())
+ .sameSite(SameSite.STRICT.attributeValue())
+ .build();
+ response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
+ }
+
+ public String getAdminRefreshToken(HttpServletRequest request) {
+ Cookie[] cookies = request.getCookies();
+ if (cookies == null || cookies.length == 0) {
+ throw new CustomException(ADMIN_REFRESH_TOKEN_NOT_EXISTS);
+ }
+
+ Cookie adminRefreshTokenCookie = Arrays.stream(cookies)
+ .filter(cookie -> properties.cookieName().equals(cookie.getName()))
+ .findFirst()
+ .orElseThrow(() -> new CustomException(ADMIN_REFRESH_TOKEN_NOT_EXISTS));
+
+ String adminRefreshToken = adminRefreshTokenCookie.getValue();
+ if (adminRefreshToken == null || adminRefreshToken.isBlank()) {
+ throw new CustomException(ADMIN_REFRESH_TOKEN_NOT_EXISTS);
+ }
+ return adminRefreshToken;
+ }
+}

src/main/java/com/example/solidconnection/admin/auth/controller/config/AdminRefreshTokenCookieProperties.java

@@ -0,0 +1,11 @@
+package com.example.solidconnection.admin.auth.controller.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@ConfigurationProperties(prefix = "token.admin-refresh")
+public record AdminRefreshTokenCookieProperties(
+ String cookieName,
+ String cookieDomain
+) {
+
+}

src/main/java/com/example/solidconnection/admin/auth/dto/AdminReissueResponse.java

@@ -0,0 +1,12 @@
+package com.example.solidconnection.admin.auth.dto;
+
+import com.example.solidconnection.auth.domain.AccessToken;
+
+public record AdminReissueResponse(
+ String accessToken
+) {
+
+ public static AdminReissueResponse from(AccessToken accessToken) {
+ return new AdminReissueResponse(accessToken.token());
+ }
+}

src/main/java/com/example/solidconnection/admin/auth/dto/AdminSignInRequest.java

@@ -0,0 +1,10 @@
+package com.example.solidconnection.admin.auth.dto;
+
+import jakarta.validation.constraints.NotBlank;
+
+public record AdminSignInRequest(
+ @NotBlank String email,
+ @NotBlank String password
+) {
+
+}

src/main/java/com/example/solidconnection/admin/auth/dto/AdminSignInResponse.java

@@ -0,0 +1,10 @@
+package com.example.solidconnection.admin.auth.dto;
+
+public record AdminSignInResponse(
+ String accessToken
+) {
+
+ public static AdminSignInResponse from(String accessToken) {
+ return new AdminSignInResponse(accessToken);
+ }
+}

src/main/java/com/example/solidconnection/admin/auth/dto/AdminSignInResult.java

@@ -0,0 +1,17 @@
+package com.example.solidconnection.admin.auth.dto;
+
+import com.example.solidconnection.auth.domain.AccessToken;
+import com.example.solidconnection.auth.domain.AdminRefreshToken;
+
+public record AdminSignInResult(
+ String accessToken,
+ String adminRefreshToken
+) {
+
+ public static AdminSignInResult of(
+ AccessToken accessToken,
+ AdminRefreshToken adminRefreshToken
+ ) {
+ return new AdminSignInResult(accessToken.token(), adminRefreshToken.token());
+ }
+}

src/main/java/com/example/solidconnection/admin/auth/service/AdminAuthService.java

@@ -0,0 +1,82 @@
+package com.example.solidconnection.admin.auth.service;
+
+import static com.example.solidconnection.common.exception.ErrorCode.ADMIN_REFRESH_TOKEN_EXPIRED;
+import static com.example.solidconnection.common.exception.ErrorCode.NOT_ADMIN_USER;
+import static com.example.solidconnection.common.exception.ErrorCode.SIGN_IN_FAILED;
+
+import com.example.solidconnection.admin.auth.dto.AdminReissueResponse;
+import com.example.solidconnection.admin.auth.dto.AdminSignInRequest;
+import com.example.solidconnection.admin.auth.dto.AdminSignInResult;
+import com.example.solidconnection.auth.domain.AccessToken;
+import com.example.solidconnection.auth.domain.AdminRefreshToken;
+import com.example.solidconnection.auth.exception.AuthException;
+import com.example.solidconnection.auth.service.AuthTokenProvider;
+import com.example.solidconnection.auth.token.TokenBlackListService;
+import com.example.solidconnection.common.exception.CustomException;
+import com.example.solidconnection.siteuser.domain.AuthType;
+import com.example.solidconnection.siteuser.domain.Role;
+import com.example.solidconnection.siteuser.domain.SiteUser;
+import com.example.solidconnection.siteuser.repository.SiteUserRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+@RequiredArgsConstructor
+public class AdminAuthService {
+
+ private final AuthTokenProvider authTokenProvider;
+ private final TokenBlackListService tokenBlackListService;
+ private final SiteUserRepository siteUserRepository;
+ private final PasswordEncoder passwordEncoder;
+
+ @Transactional
+ public AdminSignInResult signIn(AdminSignInRequest request) {
+ SiteUser siteUser = getEmailMatchingUserOrThrow(request.email());
+ validatePassword(request.password(), siteUser.getPassword());
+ validateAdminRole(siteUser);
+ resetQuitedAt(siteUser);
+ AccessToken accessToken = authTokenProvider.generateAccessToken(siteUser);
+ AdminRefreshToken adminRefreshToken = authTokenProvider.generateAndSaveAdminRefreshToken(siteUser);
+ return AdminSignInResult.of(accessToken, adminRefreshToken);
+ }
+
+ private SiteUser getEmailMatchingUserOrThrow(String email) {
+ return siteUserRepository.findByEmailAndAuthType(email, AuthType.EMAIL)
+ .orElseThrow(() -> new CustomException(SIGN_IN_FAILED));
+ }
+
+ private void validatePassword(String rawPassword, String encodedPassword) {
+ if (!passwordEncoder.matches(rawPassword, encodedPassword)) {
+ throw new CustomException(SIGN_IN_FAILED);
+ }
+ }
+
+ private void validateAdminRole(SiteUser siteUser) {
+ if (!Role.ADMIN.equals(siteUser.getRole())) {
+ throw new CustomException(NOT_ADMIN_USER);
+ }
+ }
+
+ private void resetQuitedAt(SiteUser siteUser) {
+ if (siteUser.getQuitedAt() == null) {
+ return;
+ }
+ siteUser.setQuitedAt(null);
+ }
+
+ public AdminReissueResponse reissue(String requestedAdminRefreshToken) {
+ if (!authTokenProvider.isValidAdminRefreshToken(requestedAdminRefreshToken)) {
+ throw new AuthException(ADMIN_REFRESH_TOKEN_EXPIRED);
+ }
+ SiteUser siteUser = authTokenProvider.parseSiteUser(requestedAdminRefreshToken);
+ AccessToken newAccessToken = authTokenProvider.generateAccessToken(siteUser);
+ return AdminReissueResponse.from(newAccessToken);
+ }
+
+ public void signOut(String accessToken) {
+ tokenBlackListService.addToBlacklist(accessToken);
+ authTokenProvider.deleteAdminRefreshTokenByAccessToken(accessToken);
+ }
+}

src/main/java/com/example/solidconnection/auth/controller/RefreshTokenCookieManager.java

@@ -49,7 +49,7 @@ private void setRefreshTokenCookie(
  .path(PATH)
  .maxAge(maxAge)
  .domain(properties.cookieDomain())
- .sameSite(SameSite.LAX.attributeValue())
+ .sameSite(SameSite.STRICT.attributeValue())
  .build();
  response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
  }

src/main/java/com/example/solidconnection/auth/domain/AdminRefreshToken.java

@@ -0,0 +1,7 @@
+package com.example.solidconnection.auth.domain;
+
+public record AdminRefreshToken(
+ String token
+) implements Token {
+
+}

src/main/java/com/example/solidconnection/auth/service/AuthTokenProvider.java

@@ -3,6 +3,7 @@
 import static com.example.solidconnection.common.exception.ErrorCode.USER_NOT_FOUND;
 
 import com.example.solidconnection.auth.domain.AccessToken;
+import com.example.solidconnection.auth.domain.AdminRefreshToken;
 import com.example.solidconnection.auth.domain.RefreshToken;
 import com.example.solidconnection.auth.domain.Subject;
 import com.example.solidconnection.auth.token.config.TokenProperties;
@@ -54,6 +55,16 @@ public RefreshToken generateAndSaveRefreshToken(SiteUser siteUser) {
  return tokenStorage.saveToken(subject, refreshToken);
  }
 
+ public AdminRefreshToken generateAndSaveAdminRefreshToken(SiteUser siteUser) {
+ Subject subject = toSubject(siteUser);
+ String token = tokenProvider.generateToken(
+ subject,
+ tokenProperties.adminRefresh().expireTime()
+ );
+ AdminRefreshToken adminRefreshToken = new AdminRefreshToken(token);
+ return tokenStorage.saveToken(subject, adminRefreshToken);
+ }
+
  /*
  * 유효한 리프레시 토큰인지 확인한다.
  * - 요청된 토큰과 같은 subject 의 리프레시 토큰을 조회한다.
@@ -66,11 +77,23 @@ public boolean isValidRefreshToken(String requestedRefreshToken) {
  .orElse(false);
  }
 
+ public boolean isValidAdminRefreshToken(String requestedAdminRefreshToken) {
+ Subject subject = tokenProvider.parseSubject(requestedAdminRefreshToken);
+ return tokenStorage.findToken(subject, AdminRefreshToken.class)
+ .map(foundToken -> Objects.equals(foundToken, requestedAdminRefreshToken))
+ .orElse(false);
+ }
+
  public void deleteRefreshTokenByAccessToken(String accessToken) {
  Subject subject = tokenProvider.parseSubject(accessToken);
  tokenStorage.deleteToken(subject, RefreshToken.class);
  }
 
+ public void deleteAdminRefreshTokenByAccessToken(String accessToken) {
+ Subject subject = tokenProvider.parseSubject(accessToken);
+ tokenStorage.deleteToken(subject, AdminRefreshToken.class);
+ }
+
  public SiteUser parseSiteUser(String token) {
  Subject subject = tokenProvider.parseSubject(token);
  long siteUserId = Long.parseLong(subject.value());

src/main/java/com/example/solidconnection/auth/token/config/TokenProperties.java

@@ -1,6 +1,7 @@
 package com.example.solidconnection.auth.token.config;
 
 import com.example.solidconnection.auth.domain.AccessToken;
+import com.example.solidconnection.auth.domain.AdminRefreshToken;
 import com.example.solidconnection.auth.domain.RefreshToken;
 import com.example.solidconnection.auth.domain.SignUpToken;
 import com.example.solidconnection.auth.domain.Token;
@@ -13,6 +14,7 @@
 public record TokenProperties(
  TokenConfig access,
  TokenConfig refresh,
+ TokenConfig adminRefresh,
  TokenConfig signUp,
  TokenConfig blackList
 ) {
@@ -32,6 +34,7 @@ public void init() {
  tokenConfigs = Map.of(
  AccessToken.class, access,
  RefreshToken.class, refresh,
+ AdminRefreshToken.class, adminRefresh,
  SignUpToken.class, signUp
  );
  }